authentication - sessions controller, routes, views